Phishing detection: locked-coinbase.com

Coinbase
https://locked-coinbase.com/review.php Access site
Screenshot
Screenshot of locked-coinbase.com
Investigate
Domain locked-coinbase.com2 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 104.21.3.34
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://locked-coinbase.com/review.php
urlscan Wayback archive.today
Cert YE1
crt.sh Censys Google CT
Phishunt analysis Beta
23 low suspicionheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +3.0 OpenPhish
  • +2.0 Young domain
  • +1.4 ASN reputation
  • +1.4 Registrar reputation
  • +1.1 No CSP header
  • +0.9 Young certificate
  • +0.7 Brand in cert SAN
  • +0.6 Brand impersonation in path
  • +0.6 Final host mismatch
  • +0.4 Long domain
  • +0.3 Free CA
  • +0.2 Executable page
  • +0.2 Suspicious TLD
  • +0.1 Hyphens
21 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Coinbase lookalike domain (locked-coinbase) with Coinbase in the page title and a review.php executable page, behind Cloudflare. OpenPhish flags it; likely a fake account-locked notice to harvest Coinbase credentials.

Brand impersonation in pathExecutable pageOpenPhish
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-23 · confidence 80%
Domain & Network
Whois
Registrar NICENIC INTERNATIONAL GROUP CO., LIMITED
Network
IP 104.21.3.34 Cloudflare CDN
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert YE1
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Brand owner Coinbase
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-23 13:02 UTC  ·  Last refreshed 2026-10-24 11:30 UTC